PT-2025-36567 · Plex+1 · Plex Media Server+1

D-Xuan · Published 2025-09-09 · Updated 2025-09-09 · CVE-2025-58760

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Tautulli versions prior to 2.16.0

Description: Tautulli is a Python-based monitoring and tracking tool for Plex Media Server. The /image API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. Attackers can exfiltrate files, including the tautulli.db SQLite database containing active JWT tokens and the config.ini file which contains the hashed admin password, the JWT token secret, and the Plex Media Server token and connection details. Successful exploitation could lead to administrative control over the application.

Recommendations: Update to Tautulli version 2.16.0 or later.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2025-58760

GHSA-8G4R-8F3F-HGHP

Affected Products

Plex Media Server

Tautulli

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/58xxx/CVE-2025-58760.json · Exploit
• https://github.com/Tautulli/Tautulli/commit/47566128e2e5dde98980d59b7a51b98173bc0b40 · Patch
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-8g4r-8f3f-hghp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-58760 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-58760 · Security Note
• https://reddit.com/r/Tautulli/comments/1nc5wew/important_security_update_20250908 · Reddit Post
• https://t.me/CVEtracker/32113 · Telegram Post
• https://twitter.com/CVEnew/status/1965509601128055033 · Twitter Post